release.yaml

name: Release
on:
  push:
    tags:
      - "v*"

jobs:
  release:
    name: Release
    uses: ./.github/workflows/reusable-release.yaml
    with:
      goreleaser_config: goreleaser.yml
      goreleaser_options: '--clean --timeout 90m'
    secrets:
      DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      ECR_ACCESS_KEY_ID: ${{ secrets.ECR_ACCESS_KEY_ID }}
      ECR_SECRET_ACCESS_KEY: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
      GPG_KEY: ${{ secrets.GPG_KEY }}
      GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

  deploy-packages:
    name: Deploy rpm/deb packages
    needs: release # run this job after 'release' job completes
    runs-on: ubuntu-2404-2core
    steps:
      # GITHUB_TOKEN is scoped to the current repository and cannot trigger
      # workflows in other repos — generate a GitHub App installation token instead.
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.ACTIONS_MULTI_WRITE_GH_APP_CLIENT_ID }}
          private-key: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: trivy-repo
          permission-actions: write
      - name: Trigger deploy-packages workflow in trivy-repo
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh workflow run deploy-packages.yml \
            --repo "$GITHUB_REPOSITORY_OWNER/trivy-repo" \
            --ref main \
            --field "version=$GITHUB_REF_NAME"

  # `update-chart-version` creates a new PR for updating the helm chart
  update-chart-version:
    needs: release
    runs-on: ubuntu-2404-2core
    steps:
      # GITHUB_TOKEN cannot trigger workflows on PRs it creates, so the chart
      # version PR would not run CI — generate a GitHub App installation token instead.
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_CLIENT_ID }}
          private-key: ${{ secrets.REPO_TRIVY_WRITE_GH_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: true # mage helm:updateVersion runs git push
          token: ${{ steps.app-token.outputs.token }}

      - name: Set up Git user
        run: |
          git config --global user.email "actions@github.com"
          git config --global user.name "GitHub Actions"

      - name: Set up Go
        uses: ./.github/actions/setup-go

      - name: Install Go tools
        run: go install tool # GOBIN is added to the PATH by the setup-go action

      - name: Create a PR with Trivy version
        run: mage helm:updateVersion
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

  # `trigger-version-update` triggers workflows in the `aqua` repositories to update the Trivy version.
  trigger-version-update:
    needs: release
    runs-on: ubuntu-2404-2core
    steps:
      # GITHUB_TOKEN is scoped to the current repository and cannot trigger
      # workflows in other repos — generate a GitHub App installation token instead.
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.ACTIONS_MULTI_WRITE_GH_APP_CLIENT_ID }}
          private-key: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: |
            trivy-telemetry
            trivy-downloads
            trivy-chocolatey
            trivy-action
          permission-actions: write
      - name: Trigger update_version workflow in trivy-telemetry
        if: always()
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh workflow run update_version.yml \
            --repo "$GITHUB_REPOSITORY_OWNER/trivy-telemetry" \
            --ref main \
            --field "version=$GITHUB_REF_NAME"

      - name: Trigger update_version workflow in trivy-downloads
        if: always()
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh workflow run update_version.yml \
            --repo "$GITHUB_REPOSITORY_OWNER/trivy-downloads" \
            --ref main \
            --field "version=$GITHUB_REF_NAME" \
            --field artifact=trivy

      - name: Trigger version update and release workflow in trivy-chocolatey
        if: always()
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          gh workflow run release.yml \
            --repo "$GITHUB_REPOSITORY_OWNER/trivy-chocolatey" \
            --ref main \
            --field "version=$GITHUB_REF_NAME"

      - name: Run version bump in trivy-action
        if: always()
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          gh workflow run bump-trivy.yaml \
            --repo "$GITHUB_REPOSITORY_OWNER/trivy-action" \
            --ref master \
            --field "trivy_version=$VERSION"